CVE-2026-75090

EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-bounds

State: Published
Severity: 5.3 Medium
Published: Aug 18, 2026
Updated: Aug 18, 2026
Reserved: Aug 17, 2026

Description

A vulnerability was detected in EricLBuehler Mistral.rs up to 0.8.22. Affected by this issue is the function convert_gguf_to_hf_tokenizer of the file mistralrs-core/src/gguf/gguf_tokenizer.rs of the component GGUF Tokenizer. The manipulation of the argument eos_token_id/bos_token_id/unknown_token_id results in out-of-bounds read. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 0.8.23 can resolve this issue. The patch is identified as cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55e. Upgrading the affected component is recommended.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
3.0	4.3 Medium	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C	VulDB
2.0	5.0 Medium	AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C	VulDB

Weaknesses

CWE-125 Out-of-Bounds Read
CWE-119 Memory Corruption

Affected Products

Product	Versions
Mistral.rsEricLBuehler	0.8.0Affected 0.8.1Affected 0.8.2Affected 0.8.3Affected 0.8.4Affected 0.8.5Affected 0.8.6Affected 0.8.7Affected 0.8.8Affected 0.8.9Affected 0.8.10Affected 0.8.11Affected 0.8.12Affected 0.8.13Affected 0.8.14Affected 0.8.15Affected 0.8.16Affected 0.8.17Affected 0.8.18Affected 0.8.19Affected 0.8.20Affected 0.8.21Affected 0.8.22Affected 0.8.23Not affected

References

VDB-391327 | EricLBuehler Mistral.rs GGUF Tokenizer gguf_tokenizer.rs convert_gguf_to_hf_tokenizer out-of-boundsvdb-entrytechnical-description
VDB-391327 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-75090 | CVE Analysis and Reportthird-party-advisory
Submit #877270 | EricLBuehler mistral.rs (mistralrs-core) 0.8.1 / HEAD eb31bf3 Out-of-bounds Readthird-party-advisory
https://github.com/EricLBuehler/mistral.rs/issues/2225exploitissue-tracking
https://github.com/EricLBuehler/mistral.rs/pull/2282issue-trackingpatch
https://github.com/EricLBuehler/mistral.rs/commit/cd5297e2ea5cb27c790bdcf2f3c2f1064a81d55epatch
https://github.com/EricLBuehler/mistral.rs/releases/tag/v0.8.23patch
https://github.com/EricLBuehler/mistral.rs/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.